Skill Publish To Market

• Outcome: Review
• Latest audit: May 28, 2026 · 1:50 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate skill-publishing helper, but it needs Review because it asks for powerful tokens and can create remote uploads, branches, and pull requests.

Install only if you intentionally want an agent to publish skills externally. Use a dedicated short-lived or fine-grained GitHub token where possible, avoid unnecessary workflow/private-repo access, confirm the exact platforms, files, repositories, branches, and PR/publication visibility before each run, and revoke tokens after publishing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example invocations "retry anthropic" and "status" are overly generic and could be triggered during normal conversation or reused out of context by an agent, causing unintended publishing retries or status operations. In a skill that performs external side effects across multiple platforms, ambiguous triggers materially increase the risk of accidental action.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README advertises token collection, HTTP publishing, file uploads, and PR creation without prominently warning users that the skill will handle credentials and perform irreversible external actions. This can mislead users into granting high-privilege tokens or triggering network operations without understanding the security implications.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The activation phrases include broad terms like 'submit PR', 'deploy skill', and 'upload skill', which can match ordinary development requests unrelated to marketplace publishing. In an agent context, this can cause the skill to activate unexpectedly and steer the session into credential collection and external publishing flows the user did not explicitly request.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation directs users to create GitHub tokens with broad `repo` and `workflow` scopes, but does not warn that these are highly sensitive credentials or advise minimal handling practices. In a publishing skill that performs GitHub API operations, this increases the chance users expose overprivileged tokens to the agent, logs, shell history, or unintended destinations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The recovery text asks the user for a new ClawHub token without any warning that the token is a secret that must be protected. Because this skill is designed to collect and use platform tokens, omission of safe credential-handling guidance materially raises the risk of accidental disclosure or unsafe reuse.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The playbook instructs collection and verification of GitHub and ClawHub tokens but does not clearly warn the user that the tokens will be transmitted to external services for validation. This can undermine informed consent and lead users to reveal sensitive credentials without understanding where they are being sent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: These instructions direct the skill to upload skill files and create PRs across multiple third-party platforms without an explicit warning that local content will leave the current environment. That creates a real data-exfiltration risk if users publish sensitive, proprietary, or unintended files under the assumption the action is local or internal.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The status-check workflow sends bearer tokens and publish metadata to external APIs but does not explicitly inform the user of that transmission. Even though the endpoints are legitimate, using credentials against external services without a clear warning reduces transparency and can expose sensitive repository or publishing information unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template instructs users to send bearer tokens and local skill files to third-party services, but it does not explicitly warn that credentials and repository contents are being transmitted off-host. In a publishing skill, this is expected functionality, but the lack of disclosure and consent language increases the risk of accidental token misuse, oversharing, or publishing sensitive files.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These templates perform state-changing GitHub operations including forking repositories, creating branches, uploading files, and opening pull requests, yet they do not clearly disclose that remote resources will be modified. Because this skill automates publication, the behavior is aligned with its purpose, but users still need explicit notice before external mutations occur.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Verify Token
```bash
curl -s \
  -H "Authorization: Bearer {TOKEN}" \
  -H "Accept: application/json" \
  https://clawhub.ai/api/v1/whoami

• Confidence: 88% confidence
• Finding: This request sends a bearer token to an external service for account verification. While normal for publishing workflows, any external transmission of credentials is security-sensitive, especially when the surrounding template does not emphasize destination trust, token scope, or user confirmation.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s \
  -H "Authorization: Bearer {TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/user
```
Expected: `{"login":"username",...}`

• Confidence: 87% confidence
• Finding: This template transmits a GitHub bearer token to GitHub's API to identify the authenticated user. The action is expected, but it still exposes credentials to an external endpoint and should be treated as sensitive because misuse, overbroad scopes, or silent execution could affect the user's account.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s -X POST \
  -H "Authorization: Bearer {TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/{OWNER}/{REPO}/forks \
  -d '{}'
```
Wait 3 seconds after forking.

• Confidence: 93% confidence
• Finding: This call creates a fork on GitHub using the user's token, which is both an external transmission and a remote state-changing action. In context this is part of the intended publishing flow, but without explicit notice it can unexpectedly create public artifacts or mutate the user's GitHub resources.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s -X POST \
  -H "Authorization: Bearer {TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/{USERNAME}/{REPO}/git/refs \
  -d '{"ref":"refs/heads/{BRANCH}","sha":"{BASE_SHA}"}'
```

• Confidence: 91% confidence
• Finding: This request creates a new GitHub branch using the authenticated user's credentials, which modifies remote state and can be unexpected if run without clear consent. In a PR publishing skill that behavior is legitimate, but it should be clearly disclosed because it changes repository state outside the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s -X PUT \
  -H "Authorization: Bearer {TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/{USERNAME}/{REPO}/contents/{TARGET_PATH}" \
  -d '{"message":"Add {FILE} for skill: {SKILL_NAME}","content":"'"$CONTENT"'","branch":"{BRANCH}"}'
```

• Confidence: 95% confidence
• Finding: This template uploads base64-encoded local file contents to GitHub, meaning repository contents are transmitted to an external service and committed remotely. That is core functionality for publishing, but it carries higher impact because unintended files, secrets, or proprietary content could be exposed if path selection or consent is not tightly controlled.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s -X POST \
  -H "Authorization: Bearer {TOKEN}" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/{OWNER}/{REPO}/pulls \
  -d '{"title":"Add skill: {SKILL_NAME}","head":"{USERNAME}:{BRANCH}","base":"{DEFAULT_BRANCH}","body":"Adding skill **{SKILL_NAME}** via skill-publish-to-market.\n\nFiles:\n- SKILL.md\n- references/templates.md\n- references/playbooks.md\n- references/fallbacks.md\n- references/runbook.md"}'
```
Extract: `.html_url`, `.number`

• Confidence: 92% confidence
• Finding: This call opens a pull request on GitHub using the authenticated token, which is an external, state-changing action that can create visible activity and trigger downstream workflows. In context it is expected, but users should be clearly told that a PR will be created in a third-party repository under their identity.

Static analysis

No suspicious patterns detected.